From: Paul Eggert <eggert@cs.ucla.edu>
Date: Thu, 28 Jul 2011 20:30:20 +0000 (-0700)
Subject: * character.c (Fstring): Check for size-calculation overflow.
X-Git-Tag: emacs-pretest-24.0.90~104^2~152^2~127
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=17828df2d81aef1c7886cddd881ad6f67f1e4abe;p=emacs.git

* character.c (Fstring): Check for size-calculation overflow.
---

diff --git a/src/ChangeLog b/src/ChangeLog
index b35f5607619..9f50e928fac 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,7 @@
 2011-07-28  Paul Eggert  <eggert@cs.ucla.edu>
 
+	* character.c (Fstring): Check for size-calculation overflow.
+
 	* ccl.c: Integer and memory overflow fixes.
 	(Fccl_execute_on_string): Check for memory overflow.
 	Use ptrdiff_t rather than EMACS_INT where ptrdiff_t will do.
diff --git a/src/character.c b/src/character.c
index 5e2eccf54db..50b5b252871 100644
--- a/src/character.c
+++ b/src/character.c
@@ -902,6 +902,8 @@ usage: (string &rest CHARACTERS)  */)
   Lisp_Object str;
   USE_SAFE_ALLOCA;
 
+  if (min (PTRDIFF_MAX, SIZE_MAX) / MAX_MULTIBYTE_LENGTH < n)
+    memory_full (SIZE_MAX);
   SAFE_ALLOCA (buf, unsigned char *, MAX_MULTIBYTE_LENGTH * n);
   p = buf;